1. Technical Field
The present invention relates generally to the field of computer and network security, and in particular to preventing access to data stored on a mobile device by unauthorized users.
2. Description of the Related Art
Data stored in the memory of a communication and/or computing device, such as a mobile communication device, personal digital assistant (PDA), smartphone, laptop computer, and the like, may include data of a sensitive or critical nature that is preferably accessible only by authorized users. Such data may include e-mail, calendar information, contact information in an address book, and other files including but not limited to data files created at the device or received by an authorized user at the device. One means of securing data is by encryption, using a key such as a password or a content protection key derived or secured using a user-entered password.
On occasion, it may be necessary to prevent access to data and/or applications stored or executable on a client device by deleting the data and/or applications. For example, when a client device previously used by a first individual is redeployed to another individual within the same organization, it may be desirable to delete the content of the data stores on the device associated with the first user. While the client device itself may be configured to allow an authorized user to destroy some or all data or applications stored on the device himself, a server that is authoritative for that client device may be configured to permit an administrator to issue security commands from the server to the client device to accomplish these tasks. The process of deleting data and/or applications from a mobile communication device may be described as “wiping” the device. The process of disabling user access to the data and/or applications on the mobile communication device is often referred to as “disabling” the device. Colloquially, carrying out both processes may be referred to as “killing” the device. In any event, the typical result is that the client device is rendered temporarily unusable, either because data and/or applications required for the operation of the device may have been deleted by the wiping process and must be reprovisioned before the device can be operable again, or because the disablement of the device prevents a device user from accessing the systems on the device. Since it is not desirable for the client device to comply with any security instruction received from any non-authoritative server, the client device may be configured to execute only those security instructions that are received from an authoritative server. An authoritative server is one at which the authorized user and the client device is registered, such that the server is configured to transmit commands that will be received and executed by the client device.
Because security commands will only be executed by the client device so long as the server transmitting the command is authoritative for the client, this process of wiping or disabling the client device from the server is effective only as long as the server is authoritative for that client device. However, the circumstance may arise where the client device registration at the server is deleted before a wiping or disabling command is issued to the client device, resulting in the removal of all information regarding the client device from the server. In that case, the server would no longer be authoritative for that client device, which may be problematic. For example, in the case where the employment of a user of a client device is terminated, the administrator may, as a first action, delete the user registration at the authoritative server. After that action, it may be necessary to wipe and/or disable the client device if it is determined that the user did not return the device to the organization. However, because the user's registration had already been deleted and the server had accordingly lost its status as the authoritative server for that client device, it will not be possible for the administrator to issue a “kill” command to the client device. The result is that the client device may be at large, and the sensitive data stored thereon is potentially accessible by the terminated user or by another person who manages to bypass any content protection or password security on the client device.
It is therefore desirable to provide a system and method for wiping or disabling the client device after the associated server ceases to be authoritative for that device.